Password has expired: SonarQube LDAP authentication failure

Answer

Use SonarQube’s audit log to catch LDAP password‑expiry events and run a periodic API‑based job to flag internal users whose passwords have aged beyond policy; then automatically remove any elevated roles (e.g., SONAR_ADMIN) from flagged accounts.

Confirmed facts

• SonarQube 9.x logs the exact message Password has expired when an LDAP bind fails due to an expired password.
• Internal passwords are stored as salted hashes; SonarQube does not evaluate password age natively.

Likely explanation

For LDAP users the directory is the source of truth; SonarQube only surfaces the bind failure. For internal users there is no built‑in expiration check, so age must be derived from an external timestamp (e.g., updatedAt or the passwordChangeRequired flag available from SonarQube 9.9+).

Steps for this case

1. Enable audit logging (if not already):
   

   sonar.audit.enabled=true
   sonar.audit.logfile=logs/sonar_audit.log
   

2. Forward the audit log to your SIEM/log‑aggregator and create an alert on the line containing Password has expired.
3. Deploy a scheduled job** (e.g., cron) that:
   1. Calls GET /api/users/search?ps=500 (paginate if needed) to retrieve all local users.
   2. For each user, check:
      • If passwordChangeRequired is present and true, treat as expired.
      • Otherwise, compare updatedAt (or createdAt if no change) against your password‑age policy (e.g., 90 days).
   3. Collect the login keys of users that meet the expiry condition.
   4. For each collected user, revoke elevated groups via the API:

      POST /api/permissions/remove_group_user
        with body: loginKey=<userLogin>&groupName=SONAR_ADMIN
      

4. Verify in a test environment:
   1. Expire a test LDAP user’s password, attempt login, confirm the audit log contains the expected message and triggers your alert.
   2. For an internal user, manually set updatedAt to a date older than your policy (or set passwordChangeRequired=true via DB if <9.9), run the job, and ensure the user is flagged and any SONAR_ADMIN role is removed.

Missing diagnostic detail

To decide whether to rely on the passwordChangeRequired flag or fall back to updatedAt, please confirm your SonarQube version (is it 9.9 or newer?).